Mathias Fuchs

@mathias_fuchs

Something with IR and Intelligence @InfoGuardAG, Certified Instructor and author @SANSInstitute (@SANSEMEA), Former Principal IR Consultant @Mandiant

Europe

Joined October 2009

967Following

3KFollowers

Mathias Fuchs@mathias_fuchs · Jul 13

Attackers love RDP for sneaky lateral moves—but every pixel leaves a clue! 🕵️‍♂️ Check out my latest blog on tracking attackers through logs, bitmap caches, and clipboard trails (plus a printer tale too funny to miss). #DFIR #BlueTeam #CyberSecurity medium.com/@mathias.fuchs…

mathias_fuchs's tweet card. Introduction

275

244

25.0K

Mathias Fuchs@mathias_fuchs · Jun 11

🗓 Logs lie. Prefetch tattles. ShimCache whispers. Timestamps dance. Building timelines in DFIR isn’t just science—it’s chaos theory in action. Join me in taming Chronos: medium.com/@mathias.fuchs… #DFIR #IncidentResponse #CyberSecurity

mathias_fuchs's tweet card. Building a coherent DFIR timeline can feel like wrangling the Greek god of time (Chronos) while fending off complete chaos. Timelines are…

859

Mathias Fuchs@mathias_fuchs · Jun 2

🚨 Bob from Accounting could be your biggest cyber threat. Seriously. 83% of orgs saw insider attacks last year. Tesla sabotage, Snowden leaks—your office has never felt spookier. Read how to spot & stop these insider rogues 👉medium.com/@mathias.fuchs… #CyberSecurity #InsiderThreat

mathias_fuchs's tweet card. Introduction: The Call is Coming from Inside the House

417

Mathias Fuchs@mathias_fuchs · May 21

🕵️‍♂️ How do attackers ghost past your EDR? New blog post dives deep into evasion tricks—LOLBins, memory games, syscall magic & more. Time to up your detection game! 👻🔍 👉 medium.com/@mathias.fuchs…

mathias_fuchs's tweet card. Endpoint Detection and Response (EDR) solutions are the cyber sentinels on our endpoints — vigilant guards that monitor system behavior…

792

Mathias Fuchs@mathias_fuchs · May 15

Tier 1 SOC Analysts: Highest responsibility, least experience, infinite alerts—what could go wrong? Plenty. Find out how automation and AI could save your analysts' sanity (and yours). ☕️🤖 #CyberSecurity #SOC #AI medium.com/@mathias.fuchs…

293

Mathias Fuchs@mathias_fuchs · May 12

Choosing an IR partner = Picking a parachute packer. 🪂 Know your red flags 🚩, must-haves ✅, and absolute no-gos ❌ before you're in free-fall. Dive into my latest blog 👉 medium.com/@mathias.fuchs… #CyberSecurity #IncidentResponse #DFIR #CISO

mathias_fuchs's tweet card. Selecting the right incident response (IR) partner can feel like choosing a parachute packer for your skydiving trip — you need someone…

483

Mathias Fuchs@mathias_fuchs · May 4

Last week: macOS forensics (easy!). This week: Linux forensics (not easy at all!). Ever wondered why Linux is tougher than Windows forensics? Scripts, logs, chaos! ☕🐧 #DFIR #Linux #CyberSecurity medium.com/@mathias.fuchs…

532

Mathias Fuchs@mathias_fuchs · Apr 29

Think Mac forensics is harder than Windows? Think again. 🍏 Unified logs, fewer artifacts, built-in snapshots—macOS might be easier for DFIR. Except memory. That’s still hell. 🔥 Full deep dive for IR pros here 👉 medium.com/@mathias.fuchs… #DFIR #macOS #forensics #cybersecurity

408

Mathias Fuchs@mathias_fuchs · Apr 23

🛡️ Microsoft's new ReFS filesystem is changing the rules of digital forensics & IR. NTFS artifacts are evolving—are you ready? Read our deep dive here: medium.com/@mathias.fuchs… #DFIR #ReFS #CyberSecurity #IncidentResponse #Forensics

mathias_fuchs's tweet card. A New File System, New Forensic Challenges

833

Mathias Fuchs@mathias_fuchs · Apr 15

Even the best responders can’t work miracles in the dark. 🔍 Why visibility is everything in incident response – and what EDRs & network monitoring don't tell you. Read the blog 👉 medium.com/@mathias.fuchs… #DFIR #CyberSecurity #IncidentResponse #Velociraptor

mathias_fuchs's tweet card. I never realized how much I leaned on near-omniscient visibility during investigations until I transitioned from Mandiant to InfoGuard. At Mandiant, our go-to tool was Mandiant Intelligent Response…

273

Mathias Fuchs@mathias_fuchs · Nov 5

Brilliant!

SStephan Berger@malmoeb · Sep 8, 2022

No way, this really works! 🤯 % dig txt dfir.<redacted>.<tld> +short [System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [.Forms.MessageBox]::Show('DFIR FTW!','BlueTeam <3')

659

Mathias Fuchs Retweeted

SANS DFIR@sansforensics · Oct 31

🎉 Congrats to @mathias_fuchs on being promoted to #SANS Senior Instructor! Mat is an instructor for #FOR508 & #FOR608. Congrats again, Mat! We are so lucky to have you be an instrumental part of the #DFIR curriculum! 👏 Learn more about Mat, here: sans.org/profiles/mathi…

2.0K

Mathias Fuchs@mathias_fuchs · Sep 2

What the hell is going on at @ContaboCom. Total outage of my servers. Only daily updates on the issue are not acceptable. I'll move my stuff to somewhere else.

498

Mathias Fuchs@mathias_fuchs · Jul 31

I can see how users fall for that, but 5 vendors classify it ok too, including security vendors. That domains quite a s*hole forwarder. We observed that the site forwarded to one distributing magniber ransomware.

mathias_fuchs's tweet image. I can see how users fall for that, but 5 vendors classify it ok too, including security vendors. That domains quite a s*hole forwarder. We observed that the site forwarded to one distributing magniber ransomware.

549

Mathias Fuchs@mathias_fuchs · Jan 26, 2024

Thank @shortxstack , your contributions are always great!

WWhitney Champion 🍪🚀 bluesky @whit.zip@shortxstack · Jan 24, 2024

ATTN @limacharlieio and @velocidex and @TimesketchProj nerds: i built a POC/pipeline that takes triage artifacts from the LimaCharlie Velociraptor extension, processes them, and pushes them into Timesketch for analysis💙🦖🪵 i hope this helps someone 🤓 github.com/shortstack/lcv…

974

Mathias Fuchs@mathias_fuchs · Jan 26, 2024

Does anyone have information on how Amazon will deal with the Digital Market Act specifically regarding their Echo Show 15 devices. They went to great lengths about a year ago to prevent side loading. Now I guess they are required to lift that ban again.

589

Mathias Fuchs@mathias_fuchs · Jan 6, 2024

I'm getting messages that my Memory FOR532 Class has gone - it was discontinued by SANS. I'll run an updated version of the class later this year on my own server. Thanks to @sansforensics for offering it for the last 1.5 years and to all the students and their valued feedback.

125

14.0K

Mathias Fuchs@mathias_fuchs · Dec 9, 2023

Received shocking news from @uniinnsbruck during(!) my Antarctic expedition: Despite having secured funding, I'm barred from working at the university soon. Heartless timing, and it jeopardizes scientific career. No lab access = no sample processing or publishing. Plz RT this 🧵

KKlemens Weisleitner@Kweisleitner · Oct 24, 2023

On top of this, back home in Austria, I'm fighting another storm: the uncertainty of young researchers' job security. Unsure if I can even analyze my own Antarctic samples. No word since weeks from @uniinnsbruck. Feels like being left out in the cold. ❄️💔 #notfun @AustrianPolar

153

380

159.0K